共收录 2819 条相关情报。
← 返回所有主题CVE-2026-49984
Kestra 是一个开源事件驱动编排平台。其本地内部存储后端（local internal-storage backend）在处理用户提供的文件路径时存在路径遍历漏洞。具体而言，后端在将 Windows 风格的反斜杠（\）转换为正斜杠（/）
CVE-2026-45807
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints
CVE-2026-54352
Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/ro
CVE-2026-49991
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject pe
CVE-2026-29509
Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfi
CVE-2026-56876
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file contain
CVE-2026-54557
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its inst
CVE-2026-55677
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decodi
CVE-2026-57321
Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.
CVE-2026-56066
Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
CVE-2026-13426
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path paramet
CVE-2025-64152
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issu
CVE-2025-55017
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issu
CVE-2026-57872
An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.1
CVE-2026-40084
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Tra
CVE-2026-49219
An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using
CVE-2026-56445
The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.pa
CVE-2026-56445
The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.pa
CVE-2026-55667
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec
CVE-2026-54917
SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the